exporting disassembled .text section

[isimsizolan]

hi,
Can disassembled .text section exported using PE-BEAR?

[hasherezade]

hi! do you mean automatic coping/saving to a file all the disassembled code within the section? currently it is not supported, but I can add it.

[isimsizolan]

yes precisely! it will be awesome. You truly are rock star of reversing :)

[hasherezade]

@isimsizolan - I added it. Would you like to test the new version pre-release? You can download the builds from AppVeyor server, as described in the README.

[isimsizolan]

I have tested it on some disarmed malwares, works like a charm! Thank you!

I have an another question for you, is there feasible way to do this exact operation (extracting disassemblies from section which contains EP) in large quantities in some kind of automation?

[hasherezade]

@isimsizolan - thanks for checking! I am glad that you like it.

Regarding exporting from multiple PEs, I guess you need some commandline tool for it, that would process i.e. a whole supplied directory with samples... I am thinking it is rather out of scope for PE-bear.

One possibility to make it in PE-bear, which comes to my mind, is, to add an action to export section with Entry Point from all the PEs currently loaded. Is this something that interests you?

[isimsizolan]

That feature could work just fine.

To test it I tried to load many malwares however random warnings pops on some pe files, and this warning can not be passed without user interaction. User has to be watching loading of all pe-files and click ok when warning pops up which is unfeasible because loading will take time.

[hasherezade]

I am happy to hear that it helped you! :)
and sure I will like to have a look at the set that failed to export. if you have them on some cloud drive, you can paste the link here, or contact me about it via my email: hasherezade-at-protonmail.com

[isimsizolan]

I have emailed dataset link, a list of samples which can not be exported and some other question as well
Looking forward to hear from you.

[hasherezade]

thank you, I am gonna check soon! BTW, the changes that we discussed here are now included in the official release: https://github.com/hasherezade/pe-bear/releases/tag/v0.6.5 - but I am gonna continue to work on this feature and improve it more for the next release.

[isimsizolan]

Thank you, i saw it on twitter. I have couple of new features to suggest for pe-bear which i believe will greatly increase ability for the researchers to use machine learning models. I would like to discuss it with you soon enough. You can reach me fast over email i sent to you. Have a great weekend!

[hasherezade]

cool, I am always open for suggestions about new features. we will talk soon. have a great weekend too!